Changeset 3775351

Timestamp:

10/30/2026 01:31:32 PM (2 days ago)

Author:

puppytranslator

Message:

1.0.1: nonce on the CSV export link, uninstall removes the activity log.

Location:

puppytranslator-records-import/trunk

Files:

• includes/class-puppytranslator-admin.php (modified) (1 diff)
• includes/class-puppytranslator-importer.php (modified) (1 diff)
• languages/puppytranslator-records-import.pot (modified) (1 diff)
• puppytranslator-records-import.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)
• uninstall.php (modified) (1 diff)

puppytranslator-records-import/trunk/includes/class-puppytranslator-admin.php

@@ -27 +27 @@
                                 <button type="submit" class="button"><?php echo esc_html__( 'Filter', 'puppytranslator-records-import' ); ?></button>
                                 <a class="button button-secondary" href="<?php echo esc_url( admin_url( 'admin.php?page=puppytranslator-import' ) ); ?>"><?php echo esc_html__( 'Import data', 'puppytranslator-records-import' ); ?></a>
-                                <a class="button button-secondary" href="<?php echo esc_url( admin_url( 'admin-post.php?action=puppytranslator_export' ) ); ?>"><?php echo esc_html__( 'Export CSV', 'puppytranslator-records-import' ); ?></a>
+                                <a class="button button-secondary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=puppytranslator_export' ), 'puppytranslator_export' ) ); ?>"><?php echo esc_html__( 'Export CSV', 'puppytranslator-records-import' ); ?></a>
                         </form>
                         <table class="widefat striped">

puppytranslator-records-import/trunk/includes/class-puppytranslator-importer.php

@@ -158 +158 @@
                         wp_die( esc_html__( 'You do not have permission to export records.', 'puppytranslator-records-import' ), 403 );
                 }
+                check_admin_referer( 'puppytranslator_export' );
                 $rows   = Puppytranslator_Records::export_all();
                 $header = array( 'name', 'email', 'source', 'created' );

puppytranslator-records-import/trunk/languages/puppytranslator-records-import.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: PuppyTranslator Records Importer 1.0.0\n"
+"Project-Id-Version: PuppyTranslator Records Importer 1.0.1\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/puppytranslator-records-import\n"
-POT-Creation-Date: 2026-10-16 08:43+0000\n
+"POT-Creation-Date: 2026-10-26 15:47+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

puppytranslator-records-import/trunk/puppytranslator-records-import.php

@@ -4 +4 @@
  * Plugin URI:        https://wordpress.org/plugins/puppytranslator-records-import/
  * Description:       Bulk-import CSV and JSON data into a fast, searchable records table with column mapping, validation and CSV export.
- * Version:           1.0.0
+ * Version:           1.0.1
  * Requires at least: 5.6
  * Requires PHP:      7.4
@@ -19 +19 @@
         exit;
 }
-define( 'PUPPYTRANSLATOR_VERSION', '1.0.0' );
+define( 'PUPPYTRANSLATOR_VERSION', '1.0.1' );
 define( 'PUPPYTRANSLATOR_PLUGIN_FILE', __FILE__ );
 define( 'PUPPYTRANSLATOR_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

puppytranslator-records-import/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.0.0
+Stable tag: 1.0.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -62 +62 @@
 == Changelog ==
 
+= 1.0.1 =
+* Security: the CSV export link is now nonce-protected so a third page can no
+  longer trigger a download on an author's behalf.
+* The activity-log option is removed when the plugin is uninstalled.
+
 = 1.0.0 =
 * Initial release.

puppytranslator-records-import/trunk/uninstall.php

@@ -9 +9 @@
 // Remove the saved options.
 delete_option( 'puppytranslator_profiles' );
+delete_option( 'puppytranslator_last_import' );